ECONOMYNEXT – Multiple Sri Lanka banks are alerting customers from yesterday on attempts to by hackers to direct them to fake websites where credentials can be stolen and their accounts wiped clean of cash.
The websites would also have domain names that closely resemble the actual one.
The hackers were targeting or preparing to target over a dozen banks in Sri Lanka, according to sources familiar with the matter. Cyber security experts in Sri Lanka had counterattacked the hackers after the first attacks started.
“Please remain vigilant against fraudulent websites that may impersonate the official HNB corporate website,” Sri Lanka’s Hatton National Bank said.
“Access HNB services only by typing www.hnb.lk directly into your browser or by using official HNB applications.
“Contact the bank immediately if you encounter any suspicious activity.”
“Dear Client, beware of fraudulent websites impersonating sc.com/lk,” Standard Chartered Sri Lanka said in a text message.
“Do not click on suspicious links or share your personal banking details. Always use our official website or the SC Mobile app to access our services.”
Hackers typically builds look-alike or spoof website and sends emails to customers to take urgent action such as changing passwords.
When they click link and enters the username and password in to the fake website, the hackers re-enter them on the real bank website.
The customer then gets an OTP from the real website which they enter in the fake website.
The hackers gets the OTP and enters in the real account and gain access.
The hackers can then immediately send the money to another account with or without changing passwords and withdraw the money.
“STAY ALERT! Before entering your username and password, always check the website address,” PanAsia Bank told customers.
“Use PABC Online Banking only via https://online.pabcbank.com. Watch out for fake links with small changes.Never share your OTP with anyone. Do not install unknown or suspicious apps.For help, call +94114667222.”
“BEWARE OF FAKE WEBSITES,” DFCC said. “Scam sites often use misspelled or lookalike web addresses.
“Always double check before entering any details.”
Sampath Bank sent the following message to customers:
⚠️ Don’t Fall for Scams!
Dear Sampath Vishwa User,
Scammers may attempt to contact you through methods such as payments, money receiving links, promotional offers, discounts, fake websites using Bank logos or social media messages requesting your credentials.
DO NOT enter your Sampath Vishwa login details on any link or website.
Access Sampath Vishwa ONLY via www. sampath. lk using the “LOGIN TO DIGITAL BANKING” option or Sampath Bank Mobile App. (Colombo/Apr25/2026)